v0.47.0

What's Changed

• perf: cut check CPU across YAML, gitignore, glob, and word-count hot paths by @jeduden in #600
• security: full-repo audit 2026-06-12 — 1 medium, 4 low, 2 info by @jeduden in #599
• security: MDS040 gate hardening and rename symlink write-through fix (S002, S007) by @jeduden in #601
• fix(hooks): add lstat guards to pre-merge-commit hook install/uninstall/status (S001) by @jeduden in #602
• feat(build): build execution UX — stream capture, diagnostics, --build-stream/explain/verify/jobs, log retention by @jeduden in #595
• feat(linkgraph): memoize Links and Images extraction on File by @jeduden in #603
• security: remove GOPATH fallback from merge-driver resolver, add shellQuote roundtrip tests (S002, S003) by @jeduden in #604
• perf(catalog): fast-path front-matter reads for flat-scalar files by @jeduden in #608
• perf: five allocation-budget fixes across hot paths by @jeduden in #606
• perf(engine): pool per-file source-read buffer to cut top allocator by @jeduden in #607
• fix(release): verify komac SHA256 and fix broken download URL by @jeduden in #605
• plan: mark 2606130836 done — PR #607 merged by @jeduden in #609

Full Changelog: v0.46.0...v0.47.0